SQL Injection Vulnerabilities in Mantis from MantisBT
CVE-2005-4519

Currently unrated

Key Information:

Vendor: Mantis
Status: Mantis
Vendor: CVE Published:; 28 December 2005

What is CVE-2005-4519?

The Mantis Bug Tracker versions prior to 1.0.0rc4 are susceptible to multiple SQL injection vulnerabilities. Attackers can exploit these flaws through the manage user page (manage_user_page.php) by manipulating the 'prefix' and 'sort' parameters. Additionally, vulnerabilities are present in the 'sort' parameter in the view_all_set.php file, enabling remote attackers to execute arbitrary SQL commands, which can lead to unauthorized data access or manipulation.

References

http://secunia.com/advisories/18481

third-party-advisoryx_refsource_SECUNIA

http://sourceforge.net/project/shownotes.php?release_id=3...

x_refsource_CONFIRM

http://www.securityfocus.com/bid/16046/

vdb-entryx_refsource_BID

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 28, 2005
Vulnerability Reserved
Dec 28, 2005

CVE-2005-4519 Data

JSON